Read the docs

wpwhitesecurity

Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

wpwhitesecurity records in CISA KEV

No wpwhitesecurity vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wp Activity Log 5 records MEDIUM Wp 2fa 3 records LOW Captcha 4wp 1 record LOW Website File Changes Monitor 1 record MEDIUM

Records

3 records in Wp 2fa · all components

TI-2022-01400 CVE-2022-1527 · GHSA-r695-87p8-2mvx

WP 2FA < 2.2.1 - Reflected Cross-Site Scripting

Priority LOW 29

The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00862 Published 2022-05-30 Fixed in 2.2.1 CWE-79
TI-2022-02681 CVE-2022-2891 · GHSA-354f-972f-vpc2

WP 2FA < 2.3.0 - Time-Based Side-Channel Attack

Priority LOW 28

The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00969 Published 2022-10-10 Fixed in 2.3.0 CWE-203
TI-2023-05963 CVE-2023-6506 · GHSA-5pwx-2rrr-xcvm

WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending

Priority LOW 20

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing valid…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00467 Published 2024-01-11 No fix listed CWE-639
Open these records in search →